Microsoft says only Paint version 11.2609.401.0 fixes CVE-2026-83844, a code execution flaw in the Windows image editor. Microsoft published the advisory on October 13. Yet independent checks found the fixed build in the Microsoft Store only on November 6. If your copy of Paint shows a lower number, it still has the bug.
The fix also arrives through the Store, not Windows Update. A Windows 11 PC with every monthly update installed can still run a vulnerable Paint.
What Microsoft says about the Microsoft Paint vulnerability
The Microsoft security advisory for CVE-2026-83844 describes an out-of-bounds read in Paint. In plain words, the app can read memory outside the area it should use. An attacker can abuse this to run code on the PC.
Microsoft rates the flaw “Important.” The bug was not publicly disclosed or exploited when the advisory went live. Microsoft also marks exploitation as “less likely.” A successful attack needs “a deep understanding of the system,” the company says.
The advisory lists no workaround or mitigation, as The Hacker News noted in its report on the Paint fix. It also marks the issue as needing customer action. The only fix is the new Paint build.
The severity score dropped from 8.1 to 7.0
Microsoft first gave the bug a CVSS score of 8.1. That rating assumed a network attack with no sign-in and no user action. The original FAQ described “a specially crafted packet” sent to an affected service.
On November 7, Microsoft lowered the score to 7.0. The new rating says the attack runs locally and needs the victim to act. A new FAQ states that “the word Remote in the title refers to the location of the attacker.” Its example is a victim tricked into opening a crafted file from a website. Microsoft calls the revision an informational change.
Why many PCs missed the patch
Windows Latest first reported that its PC never got the Paint fix on November 5. Its test machine ran Paint 11.2603.251.0 with Store auto-updates switched on. The Store offered no newer build. IT admins on Reddit could not find the update either, the outlet said.
The advisory added to the confusion. At first, Microsoft named 11.2605.91.0 as the fixed build. In a Microsoft Q&A thread from October 30, a user said that version did not show up anywhere. The newest Store build at the time was 11.2605.81.0. A community reply suggested a typo. No Microsoft staff member answered.
Brian Vitko of RFF then tracked the Store catalog by country. His RFF write-up on the missing Paint fix shows six markets still serving 11.2605.81.0 on November 5. A day later, the US, UK and German catalogs listed 11.2609.401.0. The Hacker News then found the fixed build in all ten countries it checked.
Timeline of the advisory and the fix
| Date (2026) | What happened |
|---|---|
| October 13 | Microsoft publishes the advisory with a CVSS score of 8.1. The fixed build is listed as 11.2605.91.0. |
| October 30 | A user on Microsoft Q&A reports that 11.2605.91.0 cannot be found. The Store tops out at 11.2605.81.0. |
| November 5 | Windows Latest reports an unpatched PC with auto-updates on. RFF finds 11.2605.81.0 as the newest build in the US, UK, Germany, Australia, India and Singapore. |
| November 6 | Microsoft revises the advisory to name 11.2609.401.0. The build appears in Store catalogs and in Paint’s Insider release notes. |
| November 7 | Microsoft cuts the score to 7.0 and adds an FAQ. The CVE record changes its threshold to 11.2609.401.0 late that day, per RFF. |
What changes for you
Home users: You need Paint 11.2609.401.0 or later. Windows Update will not install it. If your Paint is older, open the Paint page in the Microsoft Store and install any update it offers.
IT admins: Each user on a PC can have a separate copy of Paint. Windows images also carry a provisioned copy. Checking only the signed-in account can miss vulnerable copies, Vitko warns.
Security teams: Some scanners read the public CVE record. Until late November 7, that record named the old 11.2605.91.0 threshold. A scanner using it could mark a vulnerable Paint as fixed. RFF advises using 11.2609.401.0 as the cut-off.
How to check your Paint version
- Open Settings, then go to Apps and Installed apps.
- Find Paint and check its version. You may need to open “Advanced options,” PCWorld explains in its guide.
- Or run this in PowerShell:
Get-AppxPackage -Name Microsoft.Paint | Select-Object Name, Version - If the number is below 11.2609.401.0, update Paint from the Microsoft Store.
Steps for managed fleets
Vitko suggests three steps, run from an elevated PowerShell window. First, list every user’s copy with Get-AppxPackage -AllUsers -Name Microsoft.Paint. Next, check the provisioned copy with Get-AppxProvisionedPackage -Online, filtered to Microsoft.Paint. Last, push the Store update and re-run both checks.
Intune and similar tools can trigger Store app updates across many PCs, The Hacker News notes. Vitko also suggests removing Paint where nobody needs it. He did not test that step in his lab, so treat it with care.
The Store auto-update did eventually work in one test. Vitko’s Windows 11 virtual machine moved to 11.2609.401.0 on its own by November 6. He tested a single machine, so the speed of the wider rollout is unclear.
What remains unclear
Microsoft has not explained why the advisory named a build that users could not find. Its revision history first showed only the October 13 entry, with no note about the change. Windows Latest said Microsoft may have pulled the update or listed a wrong version number. Microsoft has not confirmed either idea.
The trigger for the bug is also vague. The first FAQ spoke of a network packet, which Vitko called unusual for an image editor. The newer FAQ points to a crafted file instead. Microsoft has not said which file types are involved.
The Paint release notes for Windows Insiders list version 11.2609.401.0 on November 6. They mention faster image loading and clear errors for damaged files. They do not mention a security fix.
The flaw was not in the CISA Known Exploited Vulnerabilities catalog when The Hacker News checked. NVD had not yet added affected-version data as of November 8, according to RFF.
